remotion-markup
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documents the use of official vendor packages (@remotion/*) and well-known libraries like turf and zod for geospatial and validation tasks.
- [SAFE]: Utility scripts for processing geographic data (prep-geo.mjs, prep-cesium-path.mjs) and voiceover templates are included as standard developer tools for asset preparation.
- [SAFE]: Credential management for external mapping and TTS APIs is handled via environment variables (e.g., REMOTION_MAPTILER_KEY), following security best practices.
- [INDIRECT_PROMPT_INJECTION]: The calculateMetadata feature and the voiceover implementation involve fetching and processing external data (JSON or audio), which represents a potential attack surface for indirect prompt injection if the source data is attacker-controlled. However, this is a documented feature necessary for the skill's primary purpose of creating data-driven videos.
Audit Metadata